Deployment Architecture
Highlighted

How does one find if a multisite data bucket is primary and its site id?

Explorer

Hi,

Is there a way to verify what the primality status (whether the bucket is primary) and the site affinity of a multisite bucket?

Where are those values stored relative to the bucket?

Highlighted

Re: How does one find if a multisite data bucket is primary and its site id?

Splunk Employee
Splunk Employee

check out

https://master_uri:mgmt_port/services/cluster/master/buckets/BUCKET_ID

there should be a primarybysite listing, stating which peer (by GUID) is returning results for each site. site affinity should guarantee that a site1 peer is primarybysite for site1, site2 peer is primary for site2, etc... (assuming theres a bucket present on the site of course)

View solution in original post

Highlighted

Re: How does one find if a multisite data bucket is primary and its site id?

Explorer

Thanks dxu. That's good to know.

What if one has this use case to change the siteid for a bunch of buckets to migrate it to another site?
Is that possible to do?

Is there a way to find that information physically on the file system?

I was curious as to where rebuild-bucket-manifest gets all that information to regenerate the manifests.

The same with the primality mask. Wonder if that's also stored somewhere just in case one would like to dive deeper in troubleshooting..

Thanks again.

0 Karma
Highlighted

Re: How does one find if a multisite data bucket is primary and its site id?

Splunk Employee
Splunk Employee

The primaries (primality-mask) are maintained on the Cluster Master, and they can change (for a particular bucket) from time to time (sometimes we'll rebalance the primaries so that each indexer has a similar # of primary buckets). Theres currently no command to force the master to make specific changes of it.

We also can't change where the bucket originated from (origin-site), since its embedded in the rawdata file of a bucket.

Highlighted

Re: How does one find if a multisite data bucket is primary and its site id?

Explorer

Ok I see what you mean now. Thanks for the enlightening insight Da Xu.

Looks like best way to move it is to delete the peer and stand it up under the new site.
http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Moveapeertoanewsite

0 Karma